openclaw-polymarket-trading-bot

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Most links point to benign services (localhost dashboard, ara.so, Polygon RPC, and polymarket's CLOB), but the GitHub repo is an unknown user’s trading bot that requests private keys/API secrets and would execute orders — making it a high-risk source for abusing/exfiltrating credentials or performing malicious trades if you run it unreviewed.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a trading bot that connects to Polymarket's CLOB API and executes real market orders. It requires a wallet PRIVATE_KEY and CLOB_API_KEY/CLOB_SECRET/CLOB_PASS_PHRASE, instantiates a ClobClient, calls createMarketBuyOrder/postOrder (and submitSell), and includes balance/position management and timed closing. These are direct crypto/market order execution capabilities (moving funds/trading), not generic tooling.